CVE-2026-27447
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
OpenPrinting CUPS versions 2.4.16 and prior contain an authorization bypass vulnerability due to case-insensitive username comparison. This allows an unprivileged user to gain unauthorized access to restricted operations by using a username that differs only in case from an authorized user. No public patches are available at the time of publication.
Risk Assessment
The risk involves unauthorized access to restricted operations in the CUPS printing system, potentially leading to privilege escalation and system compromise.
Recommendation
Monitor the CUPS project for a patch release and temporarily restrict access to printing services for unauthorized users.
Original NVD description (English source)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.